TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESS
South Korean authorities have linked data breaches at seven financial companies to a single attacker after finding the same IP address in every intrusion, The Korea Herald reported Monday. Investigators also found traces of a Chinese-developed AI penetration-testing tool, and financial regulators Sunday ordered firms to shut off external access to systems that do not need it.
What Happened
The list of affected firms has grown well beyond the four banks that disclosed incidents last week. Yegaram Savings Bank had the largest breach, affecting about 40,000 people, followed by Shinhan Bank at about 25,000. Welcome Savings Bank reported about 2,200 cases, KB Kookmin Bank 153, Hyundai Capital 146 and Hana Bank 89. At BNK Busan Bank, data on 11 outsourced workers was exposed. Woori Bank and NH NongHyup Bank detected intrusion attempts but blocked them.
The attacker went after less-protected noncore systems, such as sales support platforms, rather than the core banking systems that handle deposits and transfers, according to the Herald. Exposed details include names, phone numbers, annual income and borrowing limits.
RelatedThe Herald said traces point to Artex, a Chinese-developed AI-based penetration-testing platform that identifies security weaknesses and picks its next intrusion method based on the results of earlier attempts. Authorities have not confirmed that it was used.
The Financial Services Commission held an emergency meeting with financial industry heads Sunday and ordered companies to block external access to systems unless it is essential to their business. The Financial Supervisory Service set a Thursday deadline for emergency security inspections. FSC Chair Lee Eok-won said AI-driven attacks could not be ruled out and called for maximum vigilance. He said there were no signs that information directly usable for payments had leaked, but warned that the exposed data could fuel voice-phishing calls and fraudulent text messages.
President Lee Jae Myung Sunday ordered authorities to treat the matter seriously, conduct a thorough investigation and prepare countermeasures, his spokesperson Kang Yu-jung said.
Why It Matters
A common IP address across seven firms turns what looked like a run of separate bank incidents into one coordinated campaign against the sector. The pattern the Herald describes, probing secondary systems that hold customer data but sit outside the most protected networks, means a firm's defenses are only as strong as its least-watched portal.
If an automated AI tool was involved, the campaign also shows how quickly an attacker can test many institutions for the same weakness. Woori and NH NongHyup blocking the attempts shows the intrusions could be stopped, a comparison the breached firms will face as regulators review their controls.
Spending has already become part of the debate. Shinhan's 2026 information security budget of 40.59 billion won is the lowest among the four largest banks, the Herald reported, compared with 86.07 billion won at KB Kookmin, 63.63 billion won at Hana and 61.56 billion won at Woori.
How the Story Developed
The breaches came to light last week when Shinhan disclosed that loan-application data had been taken through a system used by loan brokers. As The Primary Wire reported Friday, KB Kookmin, Hana and BNK then disclosed their own leaks, and the FSC ordered banks to check internet-facing systems. A Korean security researcher had already reported finding the same AI pentest tool on servers tied to related attacks. The new disclosures add Yegaram, Welcome and Hyundai Capital, and raise KB Kookmin's count from the 119 customers it initially reported.
What to Watch
Regulators plan to overhaul the sector's security framework, with the FSC chair naming three areas: externally exposed IT assets and services, authentication and access controls, and intrusion detection. The Thursday inspection deadline could surface more affected institutions. Investigators still need to confirm whether AI tooling drove the attacks and who is behind the shared IP address, and customers of the affected firms should expect a rise in targeted phishing attempts.
